### Introduction

2019/2/6 IKEv2 compatible news came in at AWS with Site to Site VPN.

AWS Site-to-Site VPN Now Supports IKEv2  
[https://aws.amazon.com/about-aws/whats-new/2019/02/aws-site-to-site-vpn-now-supports-ikev2/](https://aws.amazon.com/about-aws/whats-new/2019/02/aws-site-to-site-vpn-now-supports-ikev2/)

The point when connecting Azure and AWS was that AWS only supported IKEv1.  
This time, it became possible to realize two-way connection by supporting IKEv2.

However, there are notes.  
BGP can not be used (it may be possible depending on settings).

The connection configuration diagram is as follows.

![](https://hackernoon.com/hn-images/0*YslGQqpvWrk-T466.jpg)

The procedure is as follows.  
Azure side  
1, Create virtual network  
2, Create gateway subnet  
3, creation of public IP  
4, Create virtual network gateway

AWS side  
5, creation of VPC  
6, Create subnet  
7, Create Internet gateway (optional)  
8, create the customer gateway statically  
9, Creating Virtual Private Gateway  
10, create a VPN connection statically  
11, download the configuration file

Azure side  
12, Create a local network gateway  
13, Create connection

AWS side  
14, add a virtual private gateway to the routing table

option  
Azure side  
15 Setting up two connections

Below, we will explain in Step by Step.

### 1, Create virtual network

Create virtual network.  
The segment on the Azure side is 10.0.0.0/16.

![](https://hackernoon.com/hn-images/0*OUYPYNTX9J8VekN7.jpg)

### 2, Create gateway subnet

Create a gateway subnet.  
Open the subnet from the virtual network screen and click on the gateway subnet to create it.

![](https://hackernoon.com/hn-images/0*nhh1m63DiShTCgHd.jpg)

Create a subnet created in 1 with another CIDR.

![](https://hackernoon.com/hn-images/0*avMByKLS-8zVk8wY.jpg)

Confirm that it was created.

![](https://hackernoon.com/hn-images/0*SprPa-s7SkRSPblM.jpg)

### 3, creation of public IP

Create a public IP.

![](https://hackernoon.com/hn-images/0*cMu85PzvUtT10l2g.jpg)

### 4, Create virtual network gateway

Create a virtual network gateway.

![](https://hackernoon.com/hn-images/0*gG8rxrqicISJUJnm.jpg)

### 5, creation of VPC

Create VPC.  
The segment on the AWS side is 192.168.0.0/16.

![](https://hackernoon.com/hn-images/0*cB0mUlfOtyMT8-6d.jpg)

### 6, Create subnet

Create a subnet.

![](https://hackernoon.com/hn-images/0*n1cwB5YuyknedwGu.jpg)

### 7, Create Internet gateway (optional)

Create Internet gateway (optional).

![](https://hackernoon.com/hn-images/0*CHdX0oXo50cRMArn.jpg)

Attach the Internet gateway to the VPC.

![](https://hackernoon.com/hn-images/0*AoK_9Hrcvpi6pIW2.jpg)

Specify the Internet gateway at 0.0.0.0/0 in the route table.

![](https://hackernoon.com/hn-images/0*AS5KBGqdX_SOtSl-.jpg)

### 8, create the customer gateway statically

Check the IP address from Azure’s virtual network gateway.

![](https://hackernoon.com/hn-images/0*hv7p3c8MsmIV8erW.jpg)

Create the customer gateway statically. Enter the IP address confirmed in the previous section in the IP address.

![](https://hackernoon.com/hn-images/0*9S8vdZyqR7LZmPBp.jpg)

### 9, Creating Virtual Private Gateway

Create Virtual Private Gateway.

![](https://hackernoon.com/hn-images/0*nJErHkuPy2aI-LQq.jpg)

### 10, create a VPN connection statically

Create a VPN connection statically. Add the subnet on the Azure side to the prefix.

![](https://hackernoon.com/hn-images/0*Ziv3b2TlapA-ZoaV.jpg)

### 11, download the configuration file

Download the configuration file. It is Generic to choose.

![](https://hackernoon.com/hn-images/0*cBbwrJnmOoqNPDF4.jpg)

Check the following.  
IPSec Tunnel # 1  
Pre-Shared Key  
Outside IP Addresses:  
\-Virtual Private Gateway

### 12, Create a local network gateway

Create a local network gateway.  
For the IP address, set the above-identified IP address (Virtual Private Gateway).  
In the address space, enter the VPC segment on the AWS side.

![](https://hackernoon.com/hn-images/0*tSLDDobX6mj1spy4.jpg)

### 13, Create connection

Add from virtual network gateway connection.

![](https://hackernoon.com/hn-images/0*clG7B8fNECVFYbxh.jpg)

Enter the confirmed common key (Pre-Shared Key).

![](https://hackernoon.com/hn-images/0*ycNUN2MVjA0kfl-S.jpg)

Confirm that it is connected.

![](https://hackernoon.com/hn-images/0*k766ayUwx2lhRr4o.jpg)

### 14, add a virtual private gateway to the routing table

Add a virtual private gateway to the routing table.

![](https://hackernoon.com/hn-images/0*Xw63MAnhph8AjFG0.jpg)

### 15 Setting up two connections

Create a local network gateway separately.  
At this time, check the IPSec Tunnel # 2 of the downloaded file and enter it.  
After creation, specify the local network gateway you created and create a connection.

By setting up two connections, communication continues even if one connection expires to some time signature.

### Communication confirmation

Azure, AWS to confirm that you can communicate with each other.

![](https://hackernoon.com/hn-images/0*Z_w7xZ_BygR4d2r7.jpg)

All of the work is completed with this.

### Throughput

I roughly measured the throughput using iperf.

Azure：Standard D2s v3 (2 vcpu、8 GB memory)  
AWS：m5.large (2 vcpu 、8 GB memory)

Azure→AWS

\------------------------------------------------------------  
Client connecting to 192.168.0.5, TCP port 5001  
TCP window size: 45.0 KByte (default)  
\------------------------------------------------------------  
\[  3\] local 10.0.0.4 port 51160 connected with 192.168.0.5 port 5001  
\[ ID\] Interval       Transfer     Bandwidth  
\[  3\]  0.0-10.0 sec   659 MBytes   553 Mbits/sec

AWS→Azure

\------------------------------------------------------------  
Client connecting to 10.0.0.4, TCP port 5001  
TCP window size: 45.0 KByte (default)  
\------------------------------------------------------------  
\[  3\] local 192.168.0.5 port 50116 connected with 10.0.0.4 port 5001  
\[ ID\] Interval       Transfer     Bandwidth  
\[  3\]  0.0-10.0 sec   759 MBytes   636 Mbits/sec

I wonder if it is usually faster than a leased line service.

### Summary

I was able to confirm that AWS can directly connect with Azure by supporting IKEv2.  
Until now, it was necessary to prepare a Windows server etc. to VPN Azure and AWS.  
There is no necessity of setting up a virtual machine by enabling VPN to be established only by the managed service,  
The need to manage has been reduced, so that we do not care about operation almost.  
I believe that Azure and AWS can be connected in a mutually managed environment so that it can be used for various purposes in the future.  
I think that Azure is good at Azure, AWS is good at using AWS, DR for use and I think that there are many useful values.  
In addition, multi cloud will proceed! !

I am very happy because it was a feature I wanted for years ago!

Original Content (Japanese) : [http://level69.net/archives/26362](http://level69.net/archives/26362)

Amazon

no cloud, no life?

Read My Stories

Too Long; Didn't Read

Get hands-on learning from ML experts on Coursera 

How to VPN connect between Azure and AWS with Managed Services.

Too Long; Didn't Read

Company Mentioned

@jkudo

RELATED STORIES